TEE Clone Detection via Cache Contention Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing trusted execution environments (TEEs) lack a mechanism to prevent malicious operating systems from creating clone applications of the same TEE on the same host, leading to potential forking attacks that can manipulate application behavior and resource usage.
Innovation Solution
A method is introduced that monitors cache contention by measuring read time periods in a memory cache to detect the presence of clone applications, using auxiliary threads to determine cache hits and misses, and employing a classifier to identify potential clones based on these measurements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the operating system allows multiple TEE application instances to run, then resource utilization improves, but security deteriorates due to forking attacks
Solution Approach 1:
The system performs preliminary actions by measuring cache access times and comparing them against thresholds before allowing TEE application execution. The cache contention detection mechanism proactively identifies potential clone applications by monitoring cache hit/miss patterns, preventing forking attacks before they can compromise security while still allowing legitimate multi-instance execution
2Reliability
If cache monitoring is implemented to detect clone applications, then security improves, but device complexity increases
Solution Approach 1:
The system employs self-service by utilizing the existing cache hierarchy and memory access patterns of the TEE applications themselves for detection. The cache contention detection mechanism leverages the natural cache behavior of legitimate applications, requiring no additional hardware or external monitoring infrastructure, thereby maintaining simplicity while achieving security
3Productivity
If multiple TEE applications share the same cache, then computational efficiency improves, but detection capability deteriorates due to cache contention masking
Solution Approach 1:
The system applies local quality by monitoring specific cache sets and lines that are most indicative of clone application behavior. Rather than monitoring the entire cache uniformly, the mechanism focuses on localized cache regions where clone applications are most likely to exhibit distinguishing access patterns, maintaining computational efficiency while preserving detection capability
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach enhances security by preventing forking attacks and conserves computational resources by identifying and preventing clone applications, thereby ensuring the integrity and confidentiality of applications within the TEE.
Implementation Method 1
measuring a plurality of read time periods associated with a plurality of monitored cache sets within a memory cache
Data Source
AI summary
A method for detecting a trusted execution environment (TEE) clone application operating on a computing device includes measuring a plurality of read time periods associated with a plurality of monitored cache sets within a memory cache based on executing a first auxiliary thread of a TEE application on the computing device. Each of the read time periods indicating a time period that is used to read data within one of the monitored cache sets. The read time periods are compared with a time threshold to determine one or more cache misses. The TEE clone application is detected as operating on the computing device based on the determined cache misses.